diff --git a/tasks/apt/cleanup.yaml b/tasks/apt/cleanup.yaml
index 2e3f32e..3e6a1fa 100644
--- a/tasks/apt/cleanup.yaml
+++ b/tasks/apt/cleanup.yaml
@@ -2,6 +2,7 @@
 
 # apt cleanup
 - name: "apt cleanup"
+  tags: "apt-cleanup"
   block:
 
     # clean apt cache
@@ -18,5 +19,3 @@
       changed_when: false
       failed_when: false
       when: 'type == "vm"'
-
-  tags: "apt-cleanup"
diff --git a/tasks/apt/config.yaml b/tasks/apt/config.yaml
index 48281e6..3cbfa06 100644
--- a/tasks/apt/config.yaml
+++ b/tasks/apt/config.yaml
@@ -2,6 +2,7 @@
 
 # apt config
 - name: "apt config"
+  tags: ["apt"]
   block:
 
     # configure apt auto update
@@ -22,6 +23,3 @@
         group: "root"
         mode: "0644"
       when: 'ansible_os_family == "Debian"'
-
-  tags:
-    - "apt"
diff --git a/tasks/apt/packages.yaml b/tasks/apt/packages.yaml
index 3ac8a87..62d66ab 100644
--- a/tasks/apt/packages.yaml
+++ b/tasks/apt/packages.yaml
@@ -2,6 +2,7 @@
 
 # apt packages
 - name: "apt packages"
+  tags: ["apt"]
   block:
 
     # install packages
@@ -25,6 +26,3 @@
       loop: "{{ apt_default_packages_delete }}"
       loop_control:
         loop_var: "apt_default_delete"
-
-  tags:
-  - "apt"
diff --git a/tasks/apt/sources.yaml b/tasks/apt/sources.yaml
index 2fc4753..84eb609 100644
--- a/tasks/apt/sources.yaml
+++ b/tasks/apt/sources.yaml
@@ -2,6 +2,7 @@
 
 # manage apt sources
 - name: "manage apt sources"
+  tags: ["apt"]
   block:
 
     # configure apt sources
@@ -38,6 +39,3 @@
       when:
         - 'ansible_distribution == "Ubuntu"'
         - 'ansible_distribution_major_version >= "24"'
-
-  tags:
-    - "apt"
diff --git a/tasks/firewall/firewall-rules-routed.yaml b/tasks/firewall/firewall-rules-routed.yaml
index b88a3d1..79fa974 100644
--- a/tasks/firewall/firewall-rules-routed.yaml
+++ b/tasks/firewall/firewall-rules-routed.yaml
@@ -2,6 +2,7 @@
 
 # basic firewall rules
 - name: "basic firewall rules"
+  tags: ["firewall"]
   block:
 
     # basic firewall rules
@@ -24,6 +25,3 @@
       with_nested:
         - "{{ __rule['source_nets'] }}"
         - "{{ __rule['destination_nets'] }}"
-        
-  tags:
-    - "firewall"
diff --git a/tasks/main.yaml b/tasks/main.yaml
index 637d850..6417a29 100644
--- a/tasks/main.yaml
+++ b/tasks/main.yaml
@@ -2,17 +2,6 @@
 
 # import ossupport and load variables
 - name: "import ossupport and load variables"
-  block:
-
-    # check os support
-    - name: "check for os support"
-      ansible.builtin.import_tasks: "ossupport.yaml"
-
-    # load os variables
-    - name: "include os specific vars"
-      ansible.builtin.include_vars: "{{ ansible_os_family }}.yaml"
-      when: "os_support"
-
   tags:
     - "apt"
     - "apt-cleanup"
@@ -34,6 +23,17 @@
     - "syslog"
     - "timezone"
     - "usermanagement"
+  block:
+
+    # check os support
+    - name: "check for os support"
+      ansible.builtin.import_tasks: "ossupport.yaml"
+
+    # load os variables
+    - name: "include os specific vars"
+      ansible.builtin.include_vars: "{{ ansible_os_family }}.yaml"
+      when: "os_support"
+
 
 # set hostname
 - name: "set hostname"
diff --git a/tasks/motd.yaml b/tasks/motd.yaml
index 0d2c7b2..603b706 100644
--- a/tasks/motd.yaml
+++ b/tasks/motd.yaml
@@ -1,6 +1,7 @@
 ---
 
 - name: "manage motd"
+  tags: ["motd"]
   block:
 
     # find old motd files
@@ -36,6 +37,3 @@
         group: "root"
         mode: "0755"
       when: 'ansible_os_family == "Debian"'
-
-  tags:
-    - "motd"
diff --git a/tasks/ntp.yaml b/tasks/ntp.yaml
index 85a01e4..b3b16aa 100644
--- a/tasks/ntp.yaml
+++ b/tasks/ntp.yaml
@@ -1,6 +1,7 @@
 ---
 
 - name: "manage ntp"
+  tags: ["ntp"]
   block:
 
     # install chrony
@@ -20,6 +21,3 @@
         mode: "0644"
       when: 'ansible_os_family == "Debian"'
       notify: "restart chrony"
-
-  tags:
-    - "ntp"
diff --git a/tasks/snap/snap_daemon.yaml b/tasks/snap/snap_daemon.yaml
index 57af142..3fe8569 100644
--- a/tasks/snap/snap_daemon.yaml
+++ b/tasks/snap/snap_daemon.yaml
@@ -2,8 +2,8 @@
 
 # manage snapd
 - name: "manage snapd"
-  block: 
-
+  tags: ["snap"]
+  block:
     # set defaults
     - name: "set facts"
       ansible.builtin.set_fact:
@@ -32,6 +32,3 @@
         state: "started"
         enabled: true
       when: "__snapd_service"
-
-  tags:
-    - "snap"
diff --git a/tasks/swap.yaml b/tasks/swap.yaml
index dc3f8ce..75b2ec8 100644
--- a/tasks/swap.yaml
+++ b/tasks/swap.yaml
@@ -2,6 +2,7 @@
 
 # manage swap
 - name: "manage swap"
+  tags: ["swap"]
   block:
 
     # enable or disable swap
@@ -76,6 +77,3 @@
         dump: "0"
         state: "absent"
       when: "not __swap"
-
-  tags:
-    - "swap"
diff --git a/tasks/syslog/config.yaml b/tasks/syslog/config.yaml
index 80e44aa..763ce1b 100644
--- a/tasks/syslog/config.yaml
+++ b/tasks/syslog/config.yaml
@@ -2,6 +2,7 @@
 
 # manage syslog
 - name: "manage syslog"
+  tags: ["syslog"]
   block:
 
     # configure rsyslogd - debian
@@ -47,6 +48,3 @@
         mode: "0644"
       when: 'ansible_os_family == "Debian"'
       notify: "restart rsyslog"
-
-  tags:
-    - "syslog"
diff --git a/tasks/user.yaml b/tasks/user.yaml
index 7b26af6..db4103d 100644
--- a/tasks/user.yaml
+++ b/tasks/user.yaml
@@ -2,6 +2,7 @@
 
 # manage users
 - name: "manage users"
+  tags: ["usermanagement"]
   block:
 
     # manage facts
@@ -69,6 +70,3 @@
         path: "/etc/sudoers.d/{{ __user['username'] }}"
       when:
         - "not sudo_file"
-
-  tags:
-    - "usermanagement"